-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper IP validation in proxy environments using IPv6. The core issue involves two key functions: 1) checkIPAllowDeny, responsible for enforcing IP-based access rules, which failed to properly verify if the client IP (from X-Forwarded-For) was allowed when behind an authorized proxy. 2) getClientIp, which likely mishandled IPv6 address parsing from headers. This is supported by the patched commits modifying IP validation logic and the vulnerability's nature (CWE-661 - Improper Enforcement of Authorization Rules). The confidence is high as the vulnerability directly maps to IP handling functions in the authentication workflow.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| phpmyadmin/phpmyadmin | composer | >= 4.6, < 4.6.4 | 4.6.4 |
| phpmyadmin/phpmyadmin | composer | >= 4.4, < 4.4.15.8 | 4.4.15.8 |
| phpmyadmin/phpmyadmin |
| composer |
| >= 4.0, < 4.0.10.17 |
| 4.0.10.17 |
KEV Misses 88% of Exploited CVEs- Get the report